CVE-2023-46604
| Affected software | 5 products, listed below |
|---|---|
| Severity | 10.0 Critical CVSS 3.1 2 scores |
| Fixed in | 5.15.16, 5.16.7, 5.17.6, 5.18.3 |
| Weakness | Deserialization of untrusted data (CWE-502) |
| Published | 27 Oct 2023 |
| Updated | 13 Nov 2026 |
Description
The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.
Exploitation status
Exploited
Confirmed real-world exploitation.
Exploitation status
- CISA KEV listed Confirmed exploitation in the wild. Added 2023-11-02 · remediation due 2023-11-23 · ransomware use: known
- VulnCheck KEV listed Exploitation reported in the wild. 71 citations · honeypot sightings · 32 exploits · earliest 2023-11-02.
- CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: total.
- Indexed PoC 38 indexed Published artifacts you can open, in GitHub PoC, Metasploit, Nuclei; first seen 2023-10-26.
- EPSS 99.9% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.
VulnCheck KEV
Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2023-46604 in VulnCheck (free account), which lists 66 more citations and 27 more exploit references not shown here.
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | Achieving a Reverse Shell Exploit for Apache ActiveMQ (CVE_2023-46604) | 126 | 2023-11-03 |
| Nuclei | Apache ActiveMQ - Remote Code Execution | ||
| Metasploit | Apache ActiveMQ Unauthenticated Remote Code Execution (excellent rank) | ||
| GitHub PoC | Apache ActiveMQ漏洞综合利用工具(CVE-2015-5254，CVE-2016-3088，CVE-2022-41678，CVE-2023-46604，CVE-2024-32114，CVE-2026-34197，CVE-2026-40466， CVE-2026-42588) | 86 | 2026-04-20 |
| GitHub PoC | ActiveMQ RCE (CVE-2023-46604) 回显利用工具 | 44 | 2024-03-05 |
| GitHub PoC | evkl1d/CVE-2023-46604 | 41 | 2023-11-04 |
| GitHub PoC | CVE-2023-46604 | 28 | 2023-10-26 |
| GitHub PoC | This script leverages CVE-2023046604 (Apache ActiveMQ) to generate a pseudo shell. The vulnerability allows for remote code execution due to unsafe deserialization within the OpenWire protocol. | 19 | 2023-11-12 |
| GitHub PoC | CVE-2023-46604 Apache ActiveMQ RCE exp 基于python | 5 | 2023-11-08 |
| GitHub PoC | A go-exploit for Apache ActiveMQ CVE-2023-46604 | 4 | 2024-04-17 |
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full Deserialization
- Action available security rule
- Review human Researcher
- Record active
| Decided by | A researcher's recorded decision for this specific CVE |
|---|---|
| Finding | A researcher found this CVE protected by the ARMR Marshal RCE rule. |
Waratek research note
written 2026-11-13Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.
Comments
Rule Name: Marshal RCE rule
How to mitigate CVE-2023-46604
Upgrade the affected software to a release that fixes it: 5.15.16, 5.16.7, 5.17.6 or 5.18.3. Until you can, Waratek RASP blocks exploitation with its deserialization rule. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
CVSS
10.0 CRITICAL
v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H
2 metrics
CVSS
10.0 CRITICAL v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H
2 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 10.0 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H |
security@apache.org | Secondary | published |
| CVSS 3.1 | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
NVD | Primary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update January 2025 ↗ | CPU | 2025-Q1 | Oracle Communications / Patches (Apache ActiveMQ) (8.2.3.0.0) |
| Oracle Critical Patch Update April 2024 ↗ | CPU | 2024-Q2 | Oracle Financial Services Applications / Miscellaneous (Apache ActiveMQ) (12.1.0.0.0) |
| Oracle Critical Patch Update January 2024 ↗ | CPU | 2024-Q1 | Oracle Communications / Security (Apache ActiveMQ) (9.0.0.0.0-9.0.2.0.1) Oracle Communications / Security (Apache ActiveMQ) (9.0.0.0.0-9.0.2.0.1) Oracle Financial Services Applications / IDM - Authentication (Apache ActiveMQ) (22.1.0, 22.2.0) Oracle Financial Services Applications / Infrastructure (Apache ActiveMQ) (8.0.7, 8.0.8, 8.0.9, 8.1.0, 8.1.1, 8.1.2) Oracle Financial Services Applications / UI General (Apache ActiveMQ) (22.1.0, 22.2.0) Oracle Fusion Middleware / General (Apache ActiveMQ) (12.2.1.4.0) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Communications | Patches (Apache ActiveMQ) | 8.2.3.0.0 | 8.2.3.0.0 |
| Oracle Communications | Security (Apache ActiveMQ) | 9.0.0.0.0-9.0.2.0.1 | |
| Oracle Financial Services Applications | IDM - Authentication (Apache ActiveMQ) | 22.1.0, 22.2.0 | 22.1.0 · 22.2.0 |
| Oracle Financial Services Applications | Infrastructure (Apache ActiveMQ) | 8.0.7, 8.0.8, 8.0.9, 8.1.0, 8.1.1, 8.1.2 | 8.0.7 · 8.0.8 · 8.0.9 · 8.1.0 · 8.1.1 · 8.1.2 |
| Oracle Financial Services Applications | Miscellaneous (Apache ActiveMQ) | 12.1.0.0.0 | 12.1.0.0.0 |
| Oracle Financial Services Applications | UI General (Apache ActiveMQ) | 22.1.0, 22.2.0 | 22.1.0 · 22.2.0 |
| Oracle Fusion Middleware | General (Apache ActiveMQ) | 12.2.1.4.0 | 12.2.1.4.0 |
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.apache.activemq:activemq-client |
0 | 5.15.16 |
unbounded |
org.apache.activemq:activemq-client |
5.16.0 | 5.16.7 |
unbounded |
org.apache.activemq:activemq-client |
5.17.0 | 5.17.6 |
unbounded |
org.apache.activemq:activemq-client |
5.18.0 | 5.18.3 |
unbounded |
org.apache.activemq:activemq-openwire-legacy |
5.8.0 | 5.15.16 |
unbounded |
org.apache.activemq:activemq-openwire-legacy |
5.16.0 | 5.16.7 |
unbounded |
org.apache.activemq:activemq-openwire-legacy |
5.17.0 | 5.17.6 |
unbounded |
org.apache.activemq:activemq-openwire-legacy |
5.18.0 | 5.18.3 |
unbounded |
Products and versions
8 products, 21 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | apache | activemq | generic | ＜ 5.15.16 · ≥ 5.16.0 and ＜ 5.16.7 · ≥ 5.17.0 and ＜ 5.17.6 · ≥ 5.18.0 and ＜ 5.18.3 |
| nvd | apache | activemq legacy openwire module | generic | ＜ 5.15.16 · ≥ 5.16.0 and ＜ 5.16.7 · ≥ 5.17.0 and ＜ 5.17.6 · ≥ 5.18.0 and ＜ 5.18.3 |
| nvd | debian | debian linux | generic | 10.0 · 11.0 |
| nvd | netapp | e-series santricity unified manager | generic | any version |
| nvd | netapp | e-series santricity web services proxy | generic | any version |
| nvd | netapp | santricity storage plugin | generic | any version |
| osv | org.apache.activemq | activemq-client | generic | ＜ 5.15.16 · ≥ 5.16.0 and ＜ 5.16.7 · ≥ 5.17.0 and ＜ 5.17.6 · ≥ 5.18.0 and ＜ 5.18.3 |
| osv | org.apache.activemq | activemq-openwire-legacy | generic | ≥ 5.8.0 and ＜ 5.15.16 · ≥ 5.16.0 and ＜ 5.16.7 · ≥ 5.17.0 and ＜ 5.17.6 · ≥ 5.18.0 and ＜ 5.18.3 |
References
Timeline
Timeline
| Published | 2023-10-27 | By the CVE Program. |
|---|---|---|
| Added to CISA KEV | 2023-11-02 | Listed in CISA's Known Exploited Vulnerabilities catalog. |
| VulnCheck KEV: earliest evidence | 2023-11-02 | Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE. |
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |
| VulnCheck KEV: latest evidence | 2026-11-06 | Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record. |
| Classification created | 2026-11-13 | First commit adding this CVE's research note. |
| Last VRT activity | 2026-11-13 | Most recent commit touching this CVE's classification, patch or rule file. |